In the prior cheat sheet, we looked at Amazon S3 Ransomware Attacks. This time, let’s take a look at effective defenses.

Special thanks to Jason Kao from Fog Security for collaborating on these cheat sheets!

Cheat Sheet Download

You can download it (and feel free to share!), and we provide a breakdown below:

Amazon S3 Ransomware Defenses

Cybr Christophe Limpalair
Fog Security Jason Kao

Defense Techniques

Prevention

IAM restrictions:

  • Bucket Policies
  • RCPs & SCPs
  • IAM least privilege

Data Deletion Prevention:

  • Object Lock
  • Versioning

Refer to footnote [1] for examples and more info

Detection

Monitor and Alerting:

  • Monitor S3 activity via CloudTrail (including data events)
  • Create CloudWatch alarms
  • Set up Lambda functions for automated response

Audit:

  • Monitor KMS Encryption Keys
  • Perform regular security audits

Recovery

Backup data:

  • Cross-account with AWS Backup
  • Isolate via IAM and separate encryption keys

Simulations:

  • Simulate ransomware attacks
  • Test recovery procedures regularly

Testing & Tools

Stratus Red Team

Cloud attack simulation framework

Tool #2
  • Launch simulated cloud attacks
  • Includes multiple S3 ransomware simulations

Website: https://stratus-red-team.cloud

Finders Keepers

KMS key resource finder

Tool #3
  • Finds resources encrypted with a specific KMS key
  • Helps determine the blast radius of compromised keys

Website: https://github.com/FogSecurity/finders-keypers

› python3 finders_keypers.py --keyarn \
  arn:aws:kms:us-east-1:123412341234:key/aaaaaaaa-aaaa-1111-aaaa-aaaa1111aaaa

Total Number of Resources encrypted with KMS Key Provided: 5
example-bucket-finderskeypers
vol-12341234123412345
vol-43214321432154321
arn:aws:dynamodb:us-east-1:123412341234:table/my-first-dynamodb-table
arn:aws:ssm:us-east-1:123412341234:parameter/sample-parameter

YES3 Scanner

S3 Security Scanner

Tool #4
  • Looks for potential S3 security issues related to access, encryption, and ransomware

Website: https://github.com/FogSecurity/yes3-scanner

› python3 yes3.py --profile <name> --region <region>

YES3 SCANNER RESULTS
AWS Account: 123412341234
Account Settings
Account Block Public Access Overall Status: OK
Bucket Summary
Total Buckets: 14
Buckets potentially public: 3
fog-pub-sample-bucket | Public Method: ['acl']
fog-pub-sample | Public Method: ['policy', 'acl']

Demo these tools with Cybr’s 1-Click Deploy Hands-On Labs

Encrypting S3 Data with SSE-KMS - AWS Console Learn how to encrypt S3 data with SSE-KMS using the AWS ConsoleS3 Ransomware Through Client-Side Encryption Test S3 ransomware through client-side encryption in a safe environmentS3 Ransomware through batch file deletion Test S3 ransomware through batch file deletion in a safe environmentSecuring S3 Against Ransomware with YES3 Use the YES3 scanning tool to discover S3 issues that could lead to ransomware

Use this cheat sheet with AI

Copy a ready-to-use prompt into your preferred AI assistant.

Preview prompt

Defense Techniques

Defending against S3 ransomware comes down to 3 main approaches:

  1. Prevention
  2. Detection
  3. Recovery

For more info on how to effectively implement all 3, check out the sources listed at the end of this post.

Prevention

For prevention, we’re primarily looking at implementing the following.

IAM restrictions:

  • Bucket Policies
  • RCPs & SCPs
  • IAM least privilege


Data Deletion Prevention:

  • Object Lock
  • Versioning

Detection

Detection mainly comes down to the following.

Monitoring and alerting:

  • Monitor S3 activity via CloudTrail (including data events)
  • Create CloudWatch alarms
  • Set up Lambda functions for automated response

Audit:

  • Monitor KMS encryption keys
  • Perform regular security audits

Recovery

To help with recovery, we need to make sure the following are in place.

Backup data:

  • Cross-account with AWS Backup
  • Isolate via IAM and separate encryption keys

Simulations:

  • Simulate ransomware attacks
  • Test recovery procedures regularly

Testing and Tools

To help you test the effectiveness of your prevention, detection, and recovery efforts, here are 4 open source tools you can deploy:

  • RansomWhen
  • Stratus Red Team
  • Finders Keepers
  • YES3 Scanner

RansomWhen

KMS-based S3 ransomware detection

Stratus Red Team

Cloud attack simulation framework

Deploy this tool for free with our Hands-On Lab >

Finders Keepers

KMS key resource finder

YES3 Scanner

S3 Security Scanner

Deploy this tool for free with our Hands-On Lab >

Sources and more info

More AWS Security cheat sheets